I’ve cleaned up everything and google took me off the list of potential attack sites (or more accurately, sites that have been compromised) but there is a possibility of course that I missed some code or the holes I sealed weren’t what they were using to get in.